Tech radar: week 19 of 2026
4–10 May 2026
In the week of 4–10 May 2026, 17 notable open-source releases shipped (including Tailwind CSS v4.3.0, Electron electron v40.10.0, Node.js v26.1.0), CISA added 3 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “Hardware Attestation as Monopoly Enabler” (2186 points).
Releases worth knowing about
Web frameworks
- Add @container-size utility (18901)
This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.mentions security
| Commit | Description |mentions security
This release includes fixes for the following security issues:mentions security
See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.mdv7150
[12.x] schedule:list display expression in the correct timezone by @xiCO2k in https://github.com/laravel/framework/pull/59307
Mobile & desktop
Fixed app.getLoginItemSettings() returning undefined for executableWillLaunchAtLogin on macOS; the property is now always a boolean. 51509 <sup(Also i
<summary<em<h4Cargo Audit</h4</em</summarymentions security
Languages & runtimes
Experimental node:ffi modulementions security
AI & machine learning
Changes since langchain-core==0.3.85mentions security
api: manual updates (13c639c)
api: add support for Managed Agents multiagents and outcomes, webhooks, vault validation (3b3deee)
Changes since checkpointsqlite==3.0.3mentions security
<img width="6604" height="3574" alt="image" src="https://github.com/user-attachments/assets/4c0fdb29-f770-463c-a97b-d24438896a4c" /
Cloud & DevOps
https://code.visualstudio.com/updates/v1119
Update urgency: SECURITY: There are security fixes in the release.mentions security
Downloads: https://elastic.co/downloads/elasticsearch
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 3.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2026-42208 | BerriAI LiteLLM | BerriAI LiteLLM SQL Injection Vulnerability | 2026-05-08 |
| CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability | 2026-05-07 |
| CVE-2026-0300 | Palo Alto Networks PAN-OS | Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability | 2026-05-06 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01Hardware Attestation as Monopoly Enabler2186 points · 755 comments · 2026-05-10
- 02Local AI needs to be the norm1903 points · 749 comments · 2026-05-10
- 03Google Chrome silently installs a 4 GB AI model on your device without consent1755 points · 1143 comments · 2026-05-05
- 04Valve releases Steam Controller CAD files under Creative Commons license1747 points · 593 comments · 2026-05-06
- 05Rumors of my death are slightly exaggerated1676 points · 257 comments · 2026-05-06
- 06Appearing productive in the workplace1634 points · 652 comments · 2026-05-06
- 07Google broke reCAPTCHA for de-googled Android users1561 points · 591 comments · 2026-05-08
- 08Talking to strangers at the gym1550 points · 753 comments · 2026-05-04
- 09Cloudflare to cut about 20% of its workforce1356 points · 998 comments · 2026-05-07
- 10Poland is now among the 20 largest economies1063 points · 875 comments · 2026-05-08
- 11Linux gaming is faster because Windows APIs are becoming Linux kernel features980 points · 663 comments · 2026-05-10
- 12Canvas online again as ShinyHunters threatens to leak schools’ data921 points · 648 comments · 2026-05-07
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.